Recovering data from 8 pin short circuited nor rom.Possible?

[Ytrezq]

Hello, I have a 8 pin Winboud spi nor rom that read as empty as part of this question https://forum.hddguru.com/viewtopic.php?f=1&t=43603.

The liquid went under the pcb so it didn t enter the Ic. I think what happened is invisible damage from the pcb caused the rom to receive a short circuit when I tried to use it again (the only thing I noticed is the drive didn t start at all). Still, there s no visible damage from outside.

The problem is data recovery services I saw only have equipment for computer flash such as micro sd cards or larger like ssd. The rom being an Ic, and spi being already low level, is it possible to recover any data, and if yes, who/which service can do it? Please also note it s the matter of a few Kb.

[fzabkar]

Remove the IC from the PCB, then power up the PCB and measure the voltage between Vcc and Ground. That should tell you whether the IC suffered an overvoltage, in which case the prognosis would be bad.

[Lardman]

Did I miss a post or have you not given us the chip model and the programmer / software you've been using to read it?

[Ytrezq]

Remove the IC from the PCB, then power up the PCB and measure the voltage between Vcc and Ground. That should tell you whether the IC suffered an overvoltage, in which case the prognosis would be bad.

It reads as 1.78Volts. But even with the ship soldered it says 1.78Volts too so does it means the rom is no longer driving current?
About the model, it s hard to read it so I can t tell.

[fzabkar]

The voltage is correct. It should not differ if it is loaded or unloaded. Nothing wrong there.

I don't recognise the part markings, though.

[fzabkar]

Maybe this is it?

https://datasheet.lcsc.com/lcsc/2108140130_onsemi-LE25S81AMDTWG_C603108.pdf

[ddrecovery]

Are we sure that is the ROM?

[Ytrezq]

Are we sure that is the ROM?

The same ic at the exact same place on the donor rom is readable soldered so quite sure.

[Ytrezq]

Maybe this is it?

https://datasheet.lcsc.com/lcsc/2108140130_onsemi-LE25S81AMDTWG_C603108.pdf

I don t know. However I noticed the 1.78Volts is present at both the pair of pin 1 5 and pin 8 4.

[ddrecovery]

Are we sure that is the ROM?

The same ic at the exact same place on the donor rom is readable soldered so quite sure.

Post a picture of the PCB for us.

[SWM]

I don t know. However I noticed the 1.78Volts is present at both the pair of pin 1 5 and pin 8 4.

Isn't it 0V in 4 contact?..

[fzabkar]

I don t know. However I noticed the 1.78Volts is present at both the pair of pin 1 5 and pin 8 4.

Isn't it 0V in 4 contact?.. :roll:

I think the OP means that there is a potential difference of 1.8V between Vcc and Gnd, and between CS* and SI. That's OK. I just hope that the IC hasn't been installed backwards.

[SWM]

I think the OP means that there is a potential difference of 1.8V between Vcc and Gnd, and between CS* and SI. That's OK. I just hope that the IC hasn't been installed backwards.

Agree.
And if all 0x00 are read - perhaps because the flash is read on the board.

[fzabkar]

And if all 0x00 are read - perhaps because the flash is read on the board.

I don't think so.

... the rom with the adaptive informations read as empty even with rom ship unsoldered.

[Ytrezq]

I don t know. However I noticed the 1.78Volts is present at both the pair of pin 1 5 and pin 8 4.

Isn't it 0V in 4 contact?..

I think the OP means that there is a potential difference of 1.8V between Vcc and Gnd, and between CS* and SI. That's OK. I just hope that the IC hasn't been installed backwards.

Correct.
Anyway, I definitely don t own a clean room to uncap the ic. So the question is who can do it? 1Kib can be done by hand using a Microscope I assume but which service does this?

[westcoast]

25P16 - 13ohm VCC to GND

gets very hot when attempt to read it, but is detected and most of the data from dump looks fine

between two dumps, there is about 5000 bytes of difference, tried to put in freezer, diff amount slightly reduced

tried to connect VCC via separate 3.3V supply using long USB cable, voltage dropped to 2.8V and amount of difference reduced to 1500 bytes

tried level shifter with 2.5V (datasheet say it operates from -0.6 to 4V) chip not detected (setup is fine as i could dump another winbond chip at 2.5V)

most of the differences are in first block 0x0 - 0x10000 (bootloader i guess), through rest of the dump there is less than 100 bytes differing

what else to try?

[fzabkar]

upload your dumps

[westcoast]

here are the two with least differences between them

Attachments

25P16.zip

(250.55 KiB) Downloaded 29 times

[fzabkar]

It seems that the bits are flipped in both directions, so I can't see any easy way to combine multiple dumps. I think you need the firmware resources from an MA01 donor, but I suspect that there may be some unique sections in the dump. I tried to find checksums, but I couldn't recognise any.

[westcoast]

translation table is stored in this chip? if yes, we know upon power failure they get damaged and bootcode automatically fix them. so i could skip that part.
i have 512GB 2.5 version of the same drive, but different vendor. could be helpful when trying to recover these sections. is there a way to dump chip without external programmer?
if i don't get MA01 dump, would flashing generic fw enable drive operation? in this case data would probably be gone, but they are not critical to save

btw it is disk from this thread https://forum.hddguru.com/viewtopic.php ... &start=100

rom chip damaged, main controller dead short on 3.3V, i got brand new parts, rest of it seems fine but i still put new 5505 and RAU chips